GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, k3s, pulumi-language-dotnet, trivy-operator-fips, apko-fips, kube-state-metrics, act, longhorn-manager, rootlesskit, cloud-provider-aws, terragrunt-fips, argo-cd-fips, nfpm, elastic-agent-fips, nuclei, kubevela-fips, mattermost, buildkitd, chisel-fips...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, k3s, trivy-operator-fips, kube-state-metrics, cloud-provider-aws, argo-cd-fips, elastic-agent-fips, kubevela-fips, mattermost, chisel-fips, rancher, zot, frankenphp-8.3, zarf-fips, trivy, kubernetes-fips, kubescape-server-fips, kubescape,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: k3s, pulumi-language-dotnet, trivy-operator-fips, crossplane-provider-aws-redshiftserverless, rootlesskit, terragrunt-fips, cloud-provider-aws, crossplane-provider-aws-dynamodb, argo-cd-fips, crossplane-provider-aws-elb, crossplane-provider-aws-sqs, flux-operator-fip...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: k3s, pulumi-language-dotnet, trivy-operator-fips, crossplane-provider-aws-redshiftserverless, rootlesskit, terragrunt-fips, cloud-provider-aws, crossplane-provider-aws-dynamodb, argo-cd-fips, crossplane-provider-aws-elb, crossplane-provider-aws-sqs, flux-operator-fip...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: k3s, buildah, kube-state-metrics, cloud-provider-aws, argo-cd-fips, elastic-agent-fips, mattermost, rancher, zot, frankenphp-8.3, terraform-fips, kubernetes-fips, prometheus-elasticsearch-exporter, kube-arangodb-fips, vault, opentelemetry-collector, harbor, opentofu,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, nfpm, fscrypt, gitea, kubescape, cosign, slsa-verifier, flux-kustomize-controller, mattermost, melange, flux-notification-controller, tekton-chains, gptscript, buildah, buildkitd, tkn, datadog-agent, tflint, kargo, vault-benchmark,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, nfpm, fscrypt, gitea, kubescape, cosign, slsa-verifier, flux-kustomize-controller, mattermost, melange, flux-notification-controller, tekton-chains, gptscript, buildah, buildkitd, tkn, datadog-agent, tflint, kargo, vault-benchmark,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: nfpm, fscrypt, gitea, kubescape, mattermost, melange, gptscript, buildkitd, datadog-agent, kubernetes, skaffold, scorecard, chisel, zarf, pulumi-kubernetes-operator, minio, apko, rootlesskit, nerdctl, prometheus-operator, guac, osv-scanner, podman, istio, gitlab-kas,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: cilium, opentelemetry-collector, fscrypt, minio, cilium-cli, mattermost, nerdctl, prometheus-operator, docker-cli-buildx, kine, spire-server, podman, istio, external-secrets-operator, kyverno, gitlab-kas, buildah, cloud-provider-aws, telegraf, cert-manager, k3s,...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386

OpenProject’s official docker image ships SECRET_KEY_BASE=OVERWRITE_ME and cookies_serializer = :marshal, creating a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader. This enables potential pre-authentication remote code execution, as noted in the ...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-54232

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. This vulnerability, a dependency confusion attack, allows a remote attacker to execute arbitrary code with root privileges during the Docker build process. By exploiting this, an attacker can compromise the...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: jmeter, ruby3.2-jrjackson, camunda, apache-nifi-registry, zaproxy, airbyte-server, confluent-kafka-jre-bcfips, apicurio-registry-fips, hono, ruby3.3-jrjackson, dependency-track-apiserver, kafbat-ui-fips, flyway-fips, apache-activemq-fips, wavefront-proxy, solr,...

CVE-2026-54515 vulnerabilities

Vulnerabilities for packages: jmeter, ruby3.2-jrjackson, camunda, apache-nifi-registry, zaproxy, airbyte-server, confluent-kafka-jre-bcfips, apicurio-registry-fips, hono, ruby3.3-jrjackson, dependency-track-apiserver, kafbat-ui-fips, flyway-fips, apache-activemq-fips, wavefront-proxy, solr,...

CVE-2026-54515 vulnerabilities

Vulnerabilities for packages: spark, thingsboard, apache-nifi, druid, akhq, neo4j, celeborn, airflow, trino, confluent-kafka, infinispan, cassandra-reaper, confluent-common-docker, dependency-track, ruby4.0-jrjackson, kserve-modelmesh, solr, keycloak, cassandra, opensearch, ruby3.2-jrjackson,...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: spark, thingsboard, apache-nifi, druid, akhq, neo4j, celeborn, airflow, trino, confluent-kafka, infinispan, cassandra-reaper, confluent-common-docker, dependency-track, ruby4.0-jrjackson, kserve-modelmesh, solr, keycloak, cassandra, opensearch, ruby3.2-jrjackson,...

SUSE SLES15: docker-stable / docker-stable-bash-completion / etc (SUSE-SU-2026:2579-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2579-1 advisory. - CVE-2026-33997: Fixed privilege validation bypass during plugin bsc1265907. - CVE-2026-34040: Fixed Authz zero length regression...

Fedora 43 : docker-buildx (2026-3cca6f41d4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3cca6f41d4 advisory. - Update to release v0.35.0 - Resolves: rhbz2487819 - Resolves CVE-2026-39828: rhbz2489918, rhbz2490102 - Upstream enhancements, new features, and...